AG02:2026 — Tool Misuse and Exploitation

QUESTION 01 OF 05

A customer service agent issues an unauthorized refund using its legitimate refund API tool. The authorization check passed and the tool worked correctly. What is the key reason this is a security failure?

Correct — this is the core of AG02. The tool was authorized, the call succeeded, and no vulnerability was exploited. The failure was entirely about intent: the refund tool was used for a purpose (unauthorized refund) that its designers never intended. Everything was authorized. The use was not.

Not quite — the key here is that nothing was unauthorized in the traditional sense. No stolen credentials, no software vulnerability, no network compromise. The authorization check passed. The tool worked. The failure was that the agent used the right tool for the wrong reason — and there was nothing to stop it.

QUESTION 02 OF 05

An agent has both a CRM query tool and an email send tool. An attacker crafts a message that causes the agent to query all customer records and email them to an external address. Each individual tool call was authorized. What type of ASI02 attack is this?

Correct — this is a classic Type 2 (Tool Chaining) attack. Each individual tool call was authorized and within scope. The attack exploited the absence of intent validation across the sequence: "does a CRM read followed immediately by an external email send make sense together?"

Not quite — Tool Chaining is the answer here. Type 1 (Over-Privileged) is when a single tool has too much capability. In this scenario, each tool's individual scope might be appropriate — the problem is combining them into an exfiltration sequence. Tool Poisoning corrupts descriptors. Loop Amplification involves repetition, not sequencing.

QUESTION 03 OF 05

In the Amazon Q Developer DNS exfiltration incident, how did the attacker exfiltrate secrets?

Correct — the attack caused the agent to use its legitimate network access tool to make DNS lookups where the hostname encoded the secret data. DNS traffic looks normal, especially at the application level. No malware, no exploit, no unauthorized credential — just a legitimate tool used as a covert channel.

Not quite — the DNS channel answer is correct. The genius (and danger) of this attack is that it used a completely legitimate network operation — DNS resolution — as the exfiltration channel. EDR sees normal DNS traffic. No code was injected onto the host. No credentials were stolen. The tool misuse was in what was being resolved.

QUESTION 04 OF 05

You have an agent with a ping tool in its auto-approved toolkit. Why is this still a security risk even if ping seems harmless?

Correct — any tool that generates outbound network traffic can be used as a data exfiltration channel, including ping. By resolving hostnames that encode secret data, an attacker can receive that data at their DNS nameserver with no HTTP traffic and no suspicious outbound connections to flag.

Not quite — the DNS exfiltration answer is right. Ping doesn't run code or give root access. But it does make DNS queries, and DNS is a network protocol that can carry data. Hostnames like "c2VjcmV0.attacker.com" look like normal DNS traffic to most monitoring tools.

QUESTION 05 OF 05

If you can only implement two of the seven ASI02 mitigations, which two provide the highest coverage across the widest range of attack scenarios?

Correct — MIT 01 (Least Privilege) appears in the mitigation column for every over-privileged tool scenario and directly reduces the blast radius of any tool misuse. MIT 04 (Intent Gate) addresses both Type 1 and Type 2 attacks by validating intent before execution. Together they cover the widest range of ASI02 attack patterns per the matrix on slide 26.

Not quite — MIT 01 and MIT 04 are the highest-coverage pair. MIT 01 (Least Privilege) shrinks tool scope, reducing the damage possible from any misuse. MIT 04 (Intent Gate) validates the purpose of each tool call before it executes, catching both injection-based and chaining-based attacks. Sandboxes and budgets are important but narrower in scope.